How to remove a rootkit that hides network connections from netstat

When malware hides network connections from netstat, the usual commands stop telling the truth. The infection sits below the operating system's normal reporting tools, so its hidden sockets stay invisible while data, credentials, or remote-desktop sessions quietly leak from the machine.

Rootkits that filter netstat output often arrive as part of a potentially unwanted program bundle or a trojanised installer. Once installed, they inject a malicious driver into the Windows kernel and patch the libraries that netstat, TCPView, and Resource Monitor rely on, producing a sanitised view that omits anything malicious.

What a netstat-hiding rootkit actually does

A kernel-level rootkit sits between the hardware and the user-mode utilities that read network state. Instead of using the documented Windows networking stack, the malware registers connections through its own driver in memory regions that netstat never inspects. Some variants patch the Native API so the enumeration routines return pre-filtered lists, which is why netstat -ano looks normal even while traffic flows to an attacker overseas.

This stealth approach mirrors the methods used by self-replicating worms that scan local networks and reuse compromised machines as jump hosts. The Australian Cyber Security Centre regularly warns about this pattern, particularly for small businesses in Brisbane or Perth running remote-desktop services that have not been patched for months.

Because the malicious driver loads early in the boot sequence, removal needs to happen from outside the running operating system.

Signs your connection list has been tampered with

The most obvious red flag is a discrepancy between the traffic your router reports and what netstat shows. If the Telstra modem in your Sydney apartment logs 40 GB of uploads during a week when you barely sent any email, but netstat -ano reports nothing unusual, the connection table is almost certainly being filtered.

Other signs include unexplained outbound connections to unfamiliar IP ranges, sudden CPU activity from an unnamed svchost.exe, and firewall service stop events that line up with a suspicious installer. Australian users often notice these issues after using public Wi-Fi at a Melbourne café or a Brisbane shopping centre, where opportunistic infections land on a laptop in minutes.

Cross-check by running Get-NetTCPConnection in PowerShell, opening TCPView from Sysinternals, and reviewing the ARP table with arp -a. If netstat and TCPView both look clean but your firewall logs show outbound traffic on high ports, the discrepancy is the giveaway.

Preparing a clean scan environment outside Windows

Before any cleanup, disconnect the machine from every network, including Wi-Fi and Ethernet, and shut it down. Pull the plug on the router if you can, or at least disable Wi-Fi on the modem so the infected PC cannot phone home while you work. The ACSC's Essential Eight guidance gives the same advice for any ransomware response, and it applies equally to rootkits.

Boot from a known-clean USB stick using a Linux-based rescue environment such as Kaspersky Rescue Disk, Bitdefender Rescue CD, or Hiren's BootCD PE. Booting from external media means the malicious kernel driver never loads, its hooks into netstat stay inactive, and its hidden files become visible. The rescue environment can mount the infected Windows volume read-only and scan it from the outside.

Your local library in Adelaide or a community workshop in Hobart can sometimes help prepare a bootable USB if you don't already have one.

Dedicated rootkit scanners that look beyond netstat

Once in a rescue environment, run several specialised detectors rather than relying on a single tool. Kaspersky's TDSSKiller, Malwarebytes Anti-Rootkit, GMER, and ESET SysRescue Live are the usual choices, each looking from a slightly different angle. Running three in sequence dramatically reduces the chance of missing a kernel implant.

TDSSKiller is especially good at finding hidden services and drivers that mimic legitimate Windows components. It flags files whose digital signatures do not match the catalogue, drivers loaded outside the standard path, and registry entries pointing to non-existent executables — the three most common persistence tricks used by this type of malware.

Pair the scan with strict execution control in Windows Defender and a Software Restriction Policy that blocks binaries from %TEMP% and %APPDATA%, the two folders most commonly used to drop rootkit payloads.

Removing persistent hooks and drivers

When a scanner finds a malicious driver, removing it is rarely a matter of deleting one file. The rootkit usually has a watchdog service that re-creates the driver the moment it is deleted, plus a scheduled task that re-downloads the payload if the infection loses contact with its command server.

You need to remove the service entry, the scheduled task, the driver file itself, and any Run keys that reference it, then reboot and repeat the scan. Some infections tamper with the Master Boot Record or EFI System Partition, so the only reliable fix is to use the rescue environment to restore a clean MBR or wipe and reinstall Windows from known-good media.

If reinstallation is required, avoid restoring a system image taken before the infection was discovered, since the rootkit may have been hiding inside it for weeks. Treat every pre-cleanup backup as compromised and scan personal documents individually before copying them back.

Verifying the system is clean and restoring trust

After removal, boot back into Windows and repeat the cross-checks: compare netstat with TCPView, with Get-NetTCPConnection, and with the live traffic shown by your router. If your Commonwealth Bank, ANZ, Westpac, or NAB account was active during the suspected window, change the password from a clean device and review the transaction history.

Run a full scan with your primary antivirus plus a second-opinion tool, then check that Windows Update is current and that Secure Boot is still on. A disabled Secure Boot setting is itself an indicator of tampering, and the machine should be treated as untrusted until rebuilt.

Finally, rotate any credentials saved in the browser, Outlook, or credential manager on the affected PC. The same advice applies when handling removing-the-reveton-ransomware-and-its-lock-screen-0803f6, where the lock screen usually harvests online-banking details while the user is being scammed into paying a fake fine.

Habits that keep rootkits from coming back

A few simple practices cut the risk of landing in the same situation again.

• Keep Secure Boot and TPM-based Measured Boot enabled in UEFI so unsigned drivers cannot load at startup.
• Apply Windows security updates within a week of release and turn on automatic updates for Office and Adobe products.
• Use a standard user account for daily work and reserve the local administrator account for software installs only.
• Avoid peer-to-peer downloads, pirated "crack" archives, and game trainers, which remain the most common delivery vector for rootkits in Australia.

Combined with a properly configured router, an offline backup, and the habit of running an offline scan whenever something feels off, these habits will stop most netstat-hiding rootkits before they ever get a foothold.